libcurl shared-HSTS-cache race leads to use-after-free with attacker-controlled function-pointer call

Missing lock on the shared HSTS cache in `lib/hsts.c` (`CURL_LOCK_DATA_HSTS`) allows a race that frees an `stsentry` still referenced by another thread — deterministic same-address reclaim proves the freed object is fully attacker-writable and its destructor pointer is called with an …

/* hsts.c:625 — inside Curl_hsts_loadfiles(): the ONLY place the HSTS
   share lock is taken */
Curl_share_lock(data, CURL_LOCK_DATA_HSTS, LOCK_ACCESS_SINGLE);